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Introduction 


Recently, the MH370 Independent Group (IG) released a preliminary assessment of data 
recovered from Captain Zaharie Shah’s home computer that were related to the Microsoft 
Flight Simulator (MSFS) game [1]. The data are in the form of fragments of “flight files”, 
which a user may create during a game to record the state of a game for future reference or 
to resume play at a future time. The particular flight files of interest were one of hundreds 
found on the computer on several drives; however, the files of interest were deleted and 
later recovered by investigators from a “shadow volume” on a single drive that was found 
disconnected from the computer. This makes the set unique among all the flight files found. 


The flight files recovered include flight and navigation parameters that are “snapshots in 
time” and are associated with six coordinates. Flight parameters derived from the raw data 
from the simulator are presented in Table 1 [1]. If these coordinates were all from a single 
simulation, it suggests that a user created a simulation of a flight of a B777-200LR aircraft 
with a departure from Kuala Lumpur International Airport (KLIA), a flight up the Malacca 
Strait, a turn to the south, and a termination in the Southern Indian Ocean near 45S 104E. 
It was also found [1] that if a great circle path that connects the final points is extended 
past the final point, the great circle would cross the McMurdo Station, Antarctica. 
(McMurdo is the largest and most populated research station in Antarctica.) This raises the 
possibility that McMurdo was used as a waypoint in the simulation with the understanding 
that there was insufficient fuel to reach it. In a subsequent paper [2], the McMurdo 
waypoint was used to reconstruct a path that also satisfies the available satellite and radar 
data. By combining all these data sets, the predicted terminus for the flight path was 
estimated to be 26.98, 100.6E, which falls outside of the current search area. This flight 
path is shown in Figure 1, together with the flight path defined by connecting the points 
found on the captain’s simulator. 


In this paper, we present further findings regarding how the simulation might have been 
created by a user. We also present more evidence that deleted data sets recovered from the 
captain’s computer were from the same simulated flight. 


The list of parameters included in each flight file is long. An abbreviated list can be found 
in Table 2, where we have rounded some of the values for convenience. Here we refer to the 
identification of each data set by its latitude, i.e., as 2N, 3N, 5N, 10N, 4581, and 4582, 
where the position for data set 2N is Runway 32R at KLIA. Each data set has an associated 
coordinate number that was assigned by investigators. There were two other data sets 
found on the captain’s computer showing the aircraft parked at KLIA. One (Coordinate 6-2) 
had all the available aircraft tanks, including the left and right auxiliary tanks, fueled to 
100%. The other (Coordinate 7) had the four side tanks (main and auxiliary) fueled to 
80.3% and center tank at 0%. As these fuel levels were not consistent with the levels for 
data set 3N (Coordinate 1), these data sets are not analyzed here. These levels might have 
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been intermediate values before the final values were selected and the simulation was 
initiated. 


Recreation of Simulated Flight 


When the captain’s computer was recovered, there were several drives with different 
versions of Microsoft Windows and Microsoft Flight Simulator installed. It was previously 
reported [1] that the deleted flight files were created using FSX, as FSX is referenced 
extensively throughout the Malaysian police report. In fact, the aircraft model used in the 
simulation was a “PSS Boeing 777-200LR No VC”, which refers to an aircraft model 
developed by Phoenix Simulation Software, now known as BlackBox Simulation. This 
aircraft model is only available for Flight Simulator 2004, also known as FS2004 and FS9. 
(The “No VC” designation refers to a version of the model that doesn’t use a “virtual 
cockpit”, which was probably chosen because the captain used external hardware and 
additional monitors for pilot inputs.) The turbine engines in the model are two GE-90s. In 
order to reproduce how the user might have created the simulator data, we created new 
simulations using FS9 and the PSS 777-200LR aircraft model. 


The position coordinates in Table 1 suggest a flight that departs from KLIA, proceeds up 
the Malacca Strait towards the Andaman Sea, and then turns with a 20-deg left bank 
towards the south and terminates with fuel exhaustion in the Southern Indian Ocean. 
Although the coordinates do not correspond to standard named waypoints, we have 
recreated the approximate path from the following series of waypoints: WMKK, AGOSA, 
GUNIP, TASEK, VAMPI, MEKAR, NILAM, IGOGU, LAGOG, DOTEN/-30, NZPG, where 
the designation DOTEN/-30 refers to a fix that is 30 nm before the waypoint DOTEN. The 
flight path following the waypoints as well as coordinates from Table 2 are shown in Figure 
2. For the recreated flight, the Flight Management Computers (FMCs) were programmed 
using a Control Data Unit (CDU). The recreated flight path was flown using LNAV and 
VNAV (lateral and vertical) navigation modes with a Cost Index (CI) of 85. The weather 
conditions were selected as “Clear Skies”, which effectively sets the atmosphere to standard 
conditions with no wind. As the aircraft consumed fuel, a stepped climb profile was followed 
to a flight level of FL400 (pressure altitude of 40,000 ft). 


The stabilizer trim (called ElevatorTrim in the flight files) allows the determination of the 
indicated airspeed (IAS). At 3N and 5N the values recorded match an IAS of 280 kn. This 
would be the VNAV climb speed of a Cost Index (CI) of 0 as implemented in the PSS FMC. 
CI=0 gives maximum range, but at a lower speed. At 10N at FL 400 and 20-deg bank angle, 
there is a high consistency with the stabilizer trim at Mach 0.806, which is the ECON 
cruise speed at CI=0. It is therefore possible that the choice of CI=85 for the reconstructed 
flight was slightly less fuel efficient than what the user had selected. 
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Weight and Fuel Consumption 


The recovered data in Table 2 suggests that the aircraft was fueled so that the left and 
right tanks were at 100% and the center tank was at 15%, where the levels are expressed 
as a fraction of the tank capacity. The actual fuel quantities are not listed in Table 2. 
However, we can infer the fuel quantities by observing that in the configuration file for this 
aircraft model, each side tank on the left and right side tank is assigned a capacity of 9,300 
gal (35,204 1) and the center tank is assigned a capacity of 26,100 gal (98,799 1). Using a 
fuel density of 0.803 kg/l, the capacity of each side tank is 28,263 kg and 79,319 kg for the 
center tank. Therefore, the total fuel when the aircraft was positioned on the runway before 
takeoff was 68,424 kg (150,714 lb). We assume the zero fuel weight (ZFW) was 179,886 kg 
(396,225 lb), which is the default value for the aircraft model, resulting in a takeoff weight 
(TOW) of 248,310 kg (546,938 lb). 


During the course of the recreated simulation, the program was stopped as the aircraft was 
close to the coordinates for each of the recovered data sets and flight files were created and 
saved for later analysis. The fuel at each location is shown in Table 3 for the recovered 
flight files as well as for the recreated flight. 


Figure 3 shows the remaining fuel plotted versus the distance traveled along the flight path 
for the recovered data sets and the recreated flight. The slope of the line between the data 
points represents the average fuel efficiency, expressed as kilograms (kg) of fuel consumed 
for each nautical mile (nm) of that flight segment. We observe that: 


e From the departure at KLIA to point 3N, the recovered data and the recreated flight 
show similar fuel consumption. 

e For the segment between 5N and 10N, the fuel efficiency for the recovered data was 
2.8 kg/nm, while that for the recreated flight was 14.4 kg/nm. This suggests that 
during this segment, either the user positioned the aircraft forward along the path, 
or fuel was added. 

e For the segment between 10N and 4581, the fuel efficiency for the recovered data 
was 18.5 kg/nm, while that for the recreated flight was 13.8 kg/nm. This suggests 
that fuel was removed by the user during this segment, reducing the range and 
leading to fuel exhaustion at 4581. 

e Inthe recreated flight, the aircraft flew an additional 449 nm past 45S1 before the 
tanks were empty. 


Manual Changes to Flight Parameters During Simulated Flight 


Using the fuel data from the recovered flight files as evidence, we can confidently say that 
flight parameters were changed during the course of the simulation. There is other 


Further Analysis of Simulator Data Related to MH370 
Victor Iannello and Yves Guillaume, November 29, 2016 


information embedded in the flight dynamic variables that provide additional clues about 
what changes were made. 


First, we need to briefly describe how velocity is recorded in flight files in FS9. The velocity 
is reported in both the “body coordinate system” and the “world coordinate system” [3]. By 
definition, in the body coordinate system, the X, Y, and Z axes are orthogonal; the Z-axis is 
parallel to the longitudinal axis of the fuselage and represents the forward-back axis; the Y 
axis represents the up-down axis; and the X-axis represents the left-right axis. For the 
“world coordinate system”, the Z axis is along the true north direction; the X axis is along 
the true east direction; and the Y axis is along the up-down axis. The two coordinate 
systems are related through a series of Euler rotations. For instance, knowing the pitch, 
bank, and heading allows the transformation from world coordinates to body coordinates. 


The sign convention in MSFS (and verified by testing) is that a positive value of pitch is 
down and a positive value of bank is to the left (left wing down, right wing up). For the turn 
rate variable HVelWorld, a positive value indicates increasing values of heading, i.e., to the 
right. Therefore, for an aircraft in a stable turn, the sign of the bank angle and HVelWorld 
are opposite. This can be seen in Table 2 for data sets 10N, 45S1 and 4582. 


When we look at the values in Table 2, we observe that for data sets 3N, 10N, 45S1, and 
4582 (but not 5N), all of which were created when the aircraft was airborne, the speeds as 
reported in the body coordinate system have XVelBodyAxis = YVelBodyAxis = 0, and the 
values of ZVelBodyAxis are non-zero. This means that the aircraft body is aligned perfectly 
with the flight path, and the angle of attack, relative to the body, is zero. 


In MSFS, the flight characteristics of an aircraft model (in this case, the PSS 777-200LR), 
are embedded in model-specific configuration files [3]. By studying the parameters that 
describe the performance of the wing, and in particular, the parameters that describe the 
relationship between the lift coefficient and the angle of attack, we determined that positive 
lift is generated for angles of attack greater than -4.2°, where the angle of attack is defined 
relative to the body axis of the aircraft. 


Now, since lift is generated for angle of attacks greater than -4.2°, even at an angle of 
attack of zero, lift is generated, and therefore it is possible that the aircraft was stable at 
this attitude. However, what is interesting is the angle of attack is EXACTLY zero for 
multiple data sets, which would be very unlikely. This led us to suspect that the variables 
in the recovered flight files represented something different than the MSFS documentation 
might suggest. 


Much time was spent trying to find the conditions for which the variables stored in the 
flight files might show the body perfectly aligned with the flight path. This included the 
investigation of flight files that were both manually and automatically created. Finally, we 
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succeeded in finding the sequence of operations in FS9 that produced saved values of 
XVelBodyAxis and YVelBodyAxis equal to zero. The steps are: 


e Pause the simulation (e.g., press the “P” key). 

e While paused, change one of the values listed in the Map window under the World 
menu item. The list of values that could be changed are indicated airspeed (IAS), 
heading, altitude, latitude, and longitude. After making the change, the value can be 
returned to the original value, if desired. 

e While still paused, create a flight file. 


Figure 4 shows a representative Map window and the parameters that may be changed by 
the user during a flight simulation session. 


After following this specific series of operations, the values before and after the change in 
flight parameters are related in the following way: 


e The new values of pitch, bank, and heading are the same as the old values. If the 
heading is manually changed, the flight file reflects the changed value. 

e The new value of altitude is the same as the old value. If the altitude is manually 
changed, the flight file reflects this changed value. However, the new value of 
altitude above ground level (AGL) remains the same as the old value. 

e Ifthe new values of latitude, longitude, altitude, heading or speed are manually 
typed into the map fields, the seconds of the latitude and longitude coordinates are 
(approximately) rounded to the nearest 0.01 minutes when the map is closed. The 
plane then changes its position by some meters. The rounding does not happen if the 
plane symbol is dragged to a new position. 

e The new airspeed is different than either the old airspeed or the new selected 
airspeed. For the standard atmosphere, there is an increase in airspeed that is a 
function of altitude (it may be that the increase is a function of the outside air 
temperature, producing the altitude dependence). At a pressure altitude of 35,000 ft, 
the increase is 8.38%. At a pressure altitude of 4,000 ft, the increase is about 2.3%. If 
the airspeed is manually changed, the new value is increased relative to this value. 

e The angle of attack (relative to the aircraft body) is set to zero so that YVelBodyAxis 
= XVelBodyAxis = 0. 

e The flight path angle of the aircraft is set equal to the pitch angle. 

e A negative (up) value of pitch will translate to a positive (up) value of vertical speed, 
even if the aircraft was flying with zero or negative vertical speed before the change. 


It is not clear why MSFS exhibits this anomaly, but the behavior has been consistently 
reproduced for multiple FS9 installations that are completely functional (FSX behaves in a 
similar way.) When the simulation is restarted, the changes in speed and attitude induced 
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by modifying values in the Map window places the aircraft in an unsteady configuration 
and induces transients in speed and pitch. 


In the recovered flight files, the plane was probably dragged directly before saving at 3N, 
10N and 45S1, as there was no rounding of the coordinates. The only indication of rounding 
occurs is for data set 4582, where the latitude is S45° 7 39.5993” (S45° 7.6600’) and the 
longitude is E104° 8’ 26.9998” (E104° 8.4500’). The rounding was likely triggered by 
entering 4000 ft in the altitude field in the map, which is also confirmed by the unchanged 
value of AGL (altitude above ground) in the flight file. 


As the map shows the projected path of the aircraft consistent with the waypoints that are 
entered in the native flight planner, it would be convenient to drag the aircraft icon forward 
along the planned path. It is also possible that the slew mode of FS9 was used. In slew 
mode the plane can be moved from the cockpit with a very high speed. But in any case, slew 
mode was off when the flights were saved, as slew mode sets several parameters to zero. 


With these discoveries, we make the following observations about the recovered flight files 
and how the user might have created these files: 


e Before manually creating the flight files at 3N, 10N, and 45S1, one of the following 
parameters were changed using the Map window: latitude, longitude, speed, 
heading, but not altitude. 

e Before manually creating the flight file at 4582, the altitude was manually changed 
from 37,654 ft to 4,000 ft in the Map window. Other parameters might have also 
changed. 

e The positive values of vertical speed (YVelWorld > 0) and negative values of pitch 
seen for data sets 3N, 10N, 4581, and 4582 indicate that the aircraft was pitched up 
relative to the horizon before the flight parameters were changed. The vertical speed 
suggested by YVelWorld is not the vertical speed before the change. The values do, 
however, accurately represent the transient state of the aircraft after the change in 
flight parameters. 


For the data sets after fuel exhaustion (4581 and 4582), the increase in pitch angle from 
1.0° to 5.9° (up) is consistent with stable flight conditions and decreasing speed. The 
positive values of vertical speed of 663 and 2,029 fpm were transient in nature and induced 
by the unsteady aerodynamic state imposed on the aircraft after the change in flight 
parameters. 


Maximum and Minimum Values as Flight Markers 


During the course of a simulated flight, FS9 keeps track of the minimum and maximum 
values of g-force (variables MinimumGForce and MaximumGForce) and also the maximum 
values of revolutions per minute (rpm) for each engine (MaxReachedEngineRPM). The g- 
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force is a measure of structural loading for the wings, where a value of 1.0 indicates steady 
flight with the wing providing the vertical force to balance the weight of the aircraft. The 
maximum engine rpm is related to the maximum rotational speed attained by the engine. 
Because these values are not reset during the flight, and because it would be rare for two 
flights to have the same values, they can serve as a marker that can link two flight files to 
the same simulated flight. 


For a GE-90 engine, 100% of N1 is 2,262 rpm and 100% N2 is 9,332 rpm. In the 
configuration file for the PSS 777-200LR, a value of 29,920 rpm is erroneously used for the 
rated value of N2. As such, all the recorded values of N2 are too high. Nonetheless, the 
values can still be used as flight markers. 


It can be seen in Table 2 that points 3N and 5N share the same values for MinimumGForce, 
MaximumGForce, and MaxReachedEngineRPM (red boxes), and therefore are likely from 
the same flight simulation. Similarly, points 10N, 4581, and 4582 share the same values 
for these parameters (blue boxes). The marker values shared by 10N, 45S1, and 45S2 are 
very useful because they definitively link the position of the aircraft in the Andaman Sea 
with the two positions in the SIO, and leave little doubt that a user created a simulation in 
which a B777 is successively positioned in the Malacca Strait, the Andaman Sea, and the 
SIO. 


Conclusions 


The data recovered from Captain Zaharie Shah’s home computer provide clues as to how a 
user might have created a simulated flight leading to fuel exhaustion. In particular: 


e The parameters related to fuel and flight dynamics show that the aircraft was 
manually positioned along the flight path. 

e The data files were manually created after certain parameters were manually 
changed. 

e The simulator appears to be fully functional, and the rates of climb after fuel 
exhaustion suggested by the flight parameters can be explained and repeated. 

e The data points in the Andaman Sea share some of the same values as the data 
points in the SIO, suggesting the flight files came from the same simulated flight. 


The evidence presented here should be viewed in the context of other evidence previously 
presented [1], where it was shown that: 


e The flight files were deleted and later recovered by investigators as a set from a 
“shadow volume’ on a single drive that was found disconnected from the computer. 

e The point in the Andaman Sea (10N) shows an aircraft banked left at 20° and 
turning towards the south. 

e When a great circle path that connects point in the Andaman Sea (10N) and the 
points in the SIO (45S1 and 4582) is extended past the final points, the great circle 
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would cross the McMurdo Station, Antarctica, suggesting that McMurdo was used as 
a waypoint in the simulation. 


The totality of the evidence suggests that it is likely that a user created a simulation on 
Microsoft Flight Simulator to create a flight that passed over the Malacca Strait to the 
Andaman Sea and to the SIO in a way that is similar to the flight path that investigators 
believe was followed by MH370. 
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Edits and Corrections 


Dec 4, 2016. The sentence “It can be seen in Table 2 that points 3N and 5N share the same 
values for MinimumGForce, MaximumGForce, and MaxReachedEngineRPM (red boxes), 
and therefore are likely from the same flight simulation.” was corrected. Previously, the 
reference was to points 5N and 10N. The data in Table 2 is unchanged. 
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Table 1. Flight Parameters Derived from Raw Simulator Data* [1] 


Latitude (deg) 2.7480 3.4151 5.1116 10.1831 -45.0852 -45.1277 
Longitude (deg) 101.7223 100.8856 98.5879 90.2245 104.1455 104.1408 
Altitude (ft) 70 23,247 32,246 40,003 37,651 4,000 
Heading (deg) 326.2 305.3 314.8 255.5 178.2 193.0 
Ground Speed (kt) 0.0 403.1 433.6 469.5 363.8 195.1 
Vertical Speed (fom) 0 3,507 1,456 3,570 663 2,029 
Turn rate (deg/s) 0.000 0.000 0.001 -0.888 0.584 0.169 


*The fuel quantities derived in [1] are omitted in favor of the updated values presented in 
Table 3. These changes represented differences between the PMDG 777-200LR and the PSS 
777-200LR aircraft models. 
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Table 2. Abbreviated List of Parameters Recovered from Deleted Flight Files 


Dataset ID 2N 3N 5N 10N 45S1 45S2 
Coordinate Number 6 1 2 3 4 5 
[SimVars] 

Latitude (deg) N2° 44' 52.6561" = N3° 24' 54.5139" N5S°6' 41.8671" N10° 10' 59.2526" 545° 5' 6.8357" S45° 7' 39.5993" 
Longitude (deg) E101° 43' 20.3843" E100° 53' 8.0655" E98° 35' 16.6071" E90° 13' 28.2634" E104° 8' 43.9576" E104° 8' 26.9998" 
Altitude (ft) 70 23247 32246 40003 37651 4000 

AGL (ft) 70 23244 32245 40003 37653 37654 
Pitch (>0 = down) (deg) -0.1 -4.91 -3.46 -4.29 -1.03 -5.86 
Bank (>0 = left) (deg) o 0.034 0.014 20.09 -10.92 -2.87 
Heading (deg) -33.85 -54.7 -45.25 -104.53 178.22 -167.01 
XVelBodyAxis (ft/s) (0) (0) 29.62 (0) (0) (0) 
YVelBodyAxis (ft/s) (0) (0) -19.87 (0) (0) (0) 
ZvelBodyAxis (ft/s) 0 682.78 731.34 794.61 614.09 330.95 
PVelBodyAxis (rad/s) (0) (0) 0.0011 (0) (0) (0) 
BVelBodyAxis (rad/s) (0) (0) -0.0011 (0) (0) (0) 
HVelBodyAxis (rad/s) O (0) (0) (0) (0) (0) 
XVelWorld (ft/s) 0 -555.17 -498.44 -767.03 19.06 -73.99 
YVelWorld (ft/s) (0) 58.4477 24.26 59.5 11.0572 33.81 
ZvelWorld (ft/s) (0) 393.1438 535.82 -198.8 -613.69649 -320.8 
PVelWorld (rad/s) 0 0.00027 -0.001067 0.000284 -0.000871 -0.001455 
BVelWorld (rad/s) (0) -0.00030317 -0.001113 -1.87E-05 -0.008335 0.00052119 
HVelWorld (rad/s) 0 -1.63E-06 1.79E-05 -0.0155 0.0102 0.0029496 
MaximumGForce (g) 1 1.4397 1.4397 2.2032 2.2032 2.2032 
MinimumGForce (g) 1 0.5958 0.5958 0.1453 0.1453 0.1453 


[Engine Parameters] 


ThrottleLeverPct1 (-) 0 0.7865 0.8768 0.9811 0.5523 0.5562 
Pct Engine RPM1 (-) 0.3158 0.9768 1.0065 1.093 0.001 0 
ThrottleLeverPct2 (-) (0) 0.7865 0.8768 0.9811 0.5252 0.5252 
Pct Engine RPM2 (-) 0.3158 0.9768 1.0065 1.093 0.001 0 
MaxReachedEngineRPM1 (rpm) (0) 31517.5 31517.5 32968.9 32968.9 32968.9 
MaxReachedEngineRPM2 (rpm) (0) 31909.4 31909.4 32968.9 32968.9 32968.9 
[Fuel] 

Fuel Center (%) 15 10.8455 9.9778 7.7843 0 0 

Fuel Left Main (%) 99.9991 99.9966 99.9966 99.9966 0 0 

Fuel Right Main (%) 99.9991 99.9966 99.9966 99.9966 0 0 

Fuel Left Aux (%) (0) (0) (0) (0) (0) (0) 

Fuel Right Aux (%) (0) (0) (0) (0) (0) (0) 


Further Analysis of Simulator Data Related to MH370 
Victor Iannello and Yves Guillaume, November 29, 2016 


Table 3. Fuel Remaining Along the Flight Path 


(Values in kg) 
2N 3N 5N 10N 45S1 
Recovered Data 68,424 65,129 64,440 62,700 (0) 
Recreated Flight 68,424 64,617 61,206 52,400 6,274 
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Figure 1. Comparison of flight path on simulator (black) and reconstructed flight path 
(yellow) of MH370, both leading to McMurdo Station, Antarctica [1]. 
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Figure 2. Flight path following waypoints in the Malacca Strait and Andaman Sea and then 


turning towards coordinate 45S and aligned with McMurdo Station, Antarctica. 
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Figure 4. Map window for changing flight parameters in FS9. 
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